radareorg vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-6942 radare2-mcp version 1.6.0 and earlier contains an os command injection vulnerability that allows remote attackers to execute arbitrary commands by bypassing theCritical 9.3 · Apr 23, 2026
• CVE-2026-40517 radare2 prior to 6.1.4 contains a command injection vulnerability in the PDB parser's print_gvars() function that allows attackers to execute arbitrary commandsHigh 8.4 · Apr 22, 2026
• CVE-2026-40527 radare2 prior to commit bc5a890 contains a command injection vulnerability in the afsv/afsvj command path where crafted ELF binaries can embed malicious r2 commHigh 8.5 · Apr 17, 2026
• CVE-2026-40499 radare2 prior to version 6.1.4 contains a command injection vulnerability in the PDB parser's print_gvars() function that allows attackers to execute arbitrary High 8.4 · Apr 15, 2026
• CVE-2025-1864 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in radareorg radare2 allows Overflow Buffers.This issue affects radare2: bCritical 10 · Mar 3, 2025
• CVE-2025-1744 Out-of-bounds Write vulnerability in radareorg radare2 allows heap-based buffer over-read or buffer overflow.This issue affects radare2: before <5.9.9.Critical 10 · Feb 27, 2025
• CVE-2023-5686 Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.9.0.High 8.8 · Oct 20, 2023
• CVE-2023-4322 Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.9.0.Critical 9.8 · Aug 14, 2023
• CVE-2023-1605 Denial of Service in GitHub repository radareorg/radare2 prior to 5.8.6.High 7.5 · Mar 23, 2023
• CVE-2023-0302 Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in GitHub repository radareorg/radare2 prior to 5.8.2.High 7.8 · Jan 14, 2023
• CVE-2022-4843 NULL Pointer Dereference in GitHub repository radareorg/radare2 prior to 5.8.2.High 7.5 · Dec 29, 2022
• CVE-2022-4398 Integer Overflow or Wraparound in GitHub repository radareorg/radare2 prior to 5.8.0.High 7.8 · Dec 10, 2022
• CVE-2022-1899 Out-of-bounds Read in GitHub repository radareorg/radare2 prior to 5.7.0.Critical 9.1 · May 26, 2022
• CVE-2022-1809 Access of Uninitialized Pointer in GitHub repository radareorg/radare2 prior to 5.7.0.High 7.8 · May 21, 2022
• CVE-2022-1714 Out-of-bounds Read in GitHub repository radareorg/radare2 prior to 5.7.0.High 7.1 · May 13, 2022
• CVE-2022-1452 Out-of-bounds Read in r_bin_java_bootstrap_methods_attr_new function in GitHub repository radareorg/radare2 prior to 5.7.0.High 7.1 · Apr 24, 2022
• CVE-2022-1451 Out-of-bounds Read in r_bin_java_constant_value_attr_new function in GitHub repository radareorg/radare2 prior to 5.7.0.High 7.1 · Apr 24, 2022
• CVE-2022-1437 Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.7.0.High 7.1 · Apr 22, 2022
• CVE-2022-1297 Out-of-bounds Read in r_bin_ne_get_entrypoints function in GitHub repository radareorg/radare2 prior to 5.6.8.Critical 9.1 · Apr 11, 2022
• CVE-2022-1296 Out-of-bounds read in `r_bin_ne_get_relocs` function in GitHub repository radareorg/radare2 prior to 5.6.8.Critical 9.1 · Apr 11, 2022
• CVE-2022-1240 Heap buffer overflow in libr/bin/format/mach0/mach0.c in GitHub repository radareorg/radare2 prior to 5.8.6.High 7.8 · Apr 6, 2022
• CVE-2022-1238 Out-of-bounds Write in libr/bin/format/ne/ne.c in GitHub repository radareorg/radare2 prior to 5.6.8.High 7.8 · Apr 6, 2022
• CVE-2022-1237 Improper Validation of Array Index in GitHub repository radareorg/radare2 prior to 5.6.8.High 7.8 · Apr 6, 2022
• CVE-2022-1061 Heap Buffer Overflow in parseDragons in GitHub repository radareorg/radare2 prior to 5.6.8.High 7.5 · Mar 24, 2022
• CVE-2022-1031 Use After Free in op_is_set_bp in GitHub repository radareorg/radare2 prior to 5.6.6.High 7.8 · Mar 22, 2022